Ethereum’s EIP-7702 let an attacker drain about $2.5 billion from a Binance wallet in less than four minutes

Binance says the theft across several blockchains reached $6.3 billion, and on Ethereum the key detail was not a broken signature scheme but a permission: EIP-7702. For PSPs and exchanges, the useful part here is simple enough — one signed authorization can turn an ordinary wallet into a contract wallet until it is replaced or cancelled onchain.

1. An attacker used Ethereum’s EIP-7702 feature, which went live in May 2025 as part of the Pectra upgrade, to make a Binance wallet run malicious smart-contract code. Less than four minutes after the permission was signed, about $2.5 billion in ether and tokens was gone.
2. EIP-7702 lets an ordinary wallet borrow smart-contract code by signing a short authorization that points to a contract. Once accepted, that contract runs as if it were the wallet’s own code, and anyone can submit the signed authorization to the network. The authorization stays in place until a replacement or cancellation is recorded onchain.
3. The feature was originally meant to help everyday wallets batch payments and let someone else pay transaction fees. Within weeks of launch, Wintermute found that most EIP-7702 delegations pointed at copy-pasted “sweeper” scripts, which automatically forward a wallet’s funds to a thief once the key has leaked.
4. According to a reconstruction of the network, the attacker’s main wallet, 0x7C86…5CA0, was funded through Tornado Cash in small withdrawals starting Wednesday. On Thursday afternoon UTC, the attacker rehearsed the attack on its own wallets and deployed a sweeper contract, 0x63e8…6fAe, whose code only lets the attacker’s wallet operate it.
5. At 20:20:59 UTC, the attacker sent one transaction carrying 50 authorizations, each signed by the wallet Etherscan labels “Binance 14.” Binance said losses across several blockchains reached $6.3 billion and pledged to cover them while investigators continue to examine how the attacker obtained authorization to move the funds.

The operational lesson for high-risk payments teams is not just about Ethereum. It is about what happens when a valid signature is enough to grant long-lived control over funds, especially when deposits keep arriving while the permission is still active.